Method and apparatus for passing security configuration information between a client and a security policy server

Abstract

Techniques for passing security configuration information between a security policy server and a client includes the client forming a request for security configuration information that configures the client for secure communications. The client is separated by an untrusted network from a trusted network that includes the security policy sever. A tag is generated that indicates a generic security configuration attribute. An Internet Security Association and Key Management Protocol (ISAKMP) configuration mode request message is sent to a security gateway on an edge of the trusted network connected to the untrusted network. The message includes the request in association with the tag. The gateway sends the request associated with the tag to the security policy server on the trusted network and does not interpret the request. The techniques allow client configuration extensions to be added by modifying the policy server or security client, or both, without modifying the gateway.

Description

CROSS-REFERENCE TO RELATED APPLICATION(S); PRIORITY CLAIM[0001]This application claims the benefit as a Continuation of application Ser. No. 10 / 226,887, filed Aug. 22, 2002 now U.S. Pat. No. 7,849,795 the entire contents of which is hereby incorporated by reference as if fully set forth herein, under 35 U.S.C. §120. The applicant(s) hereby rescind any disclaimer of claim scope in the parent application(s) or the prosecution history thereof and advise the USPTO that the claims in this application may be broader than any claim in the parent application(s).FIELD OF THE INVENTION[0002]The present invention generally relates to configuring a client for secure communications over a network. The invention relates more specifically to passing security configuration information between a client and a security policy server using the Internet Security Association and Key Management Protocol (ISAKMP).BACKGROUND OF THE INVENTION[0003]The approaches described in this section could be pursued, bu...

AI Technical Summary

Problems solved by technology

A problem arises with Config Mode when the security policy for a remote client is extended with additional security attributes.

If the gateway does not know how to interpret the request for additional attributes in the ISAKMP Config Mode request, then the gateway does not know how to construct the message to send to the policy server according to the policy server protocol.

If the gateway does not know how to interpret the message from the policy server, which includes the additional information from the policy server, then the gateway does not know how to construct the ISAKMP Config Mode reply message to send to the client.

Reprogramming security gateways with each new security attribute used to configure remote clients is undesirable.

In addition, because updated versions of these devices and software are released at different times, it is difficult to synchronize the behavior of all these devices with respect to new features, such as new security attributes exchanged via Config Mode.

Images